Phase 1 - AWS Infrastructure

cd environments/dev
export SSL_CERT_FILE=$(python3 -c "import certifi; print(certifi.where())")

terraform apply \
  -target=module.vpc \
  -target=module.eks \
  -target=module.rds \
  -target=module.s3 \
  -target=module.iam \
  -auto-approve

Resources created: VPC, subnets, EKS cluster, node group, RDS PostgreSQL, S3 bucket, ECR repositories, IAM roles.

Expected output:

Apply complete! Resources: 41 added, 0 changed, 0 destroyed.

Grant Cluster Access

After Phase 1, grant your IAM user and GitHub Actions role access to the cluster:

aws eks update-kubeconfig --name fintrack-dev --region us-east-1

aws eks create-access-entry \
  --cluster-name fintrack-dev \
  --principal-arn arn:aws:iam::203637463799:user/eks-project-user \
  --region us-east-1 2>/dev/null || true

aws eks associate-access-policy \
  --cluster-name fintrack-dev \
  --principal-arn arn:aws:iam::203637463799:user/eks-project-user \
  --policy-arn arn:aws:eks::aws:cluster-access-policy/AmazonEKSClusterAdminPolicy \
  --access-scope type=cluster \
  --region us-east-1

aws eks create-access-entry \
  --cluster-name fintrack-dev \
  --principal-arn arn:aws:iam::203637463799:role/fintrack-dev-github-actions-role \
  --region us-east-1 2>/dev/null || true

aws eks associate-access-policy \
  --cluster-name fintrack-dev \
  --principal-arn arn:aws:iam::203637463799:role/fintrack-dev-github-actions-role \
  --policy-arn arn:aws:eks::aws:cluster-access-policy/AmazonEKSClusterAdminPolicy \
  --access-scope type=cluster \
  --region us-east-1

Phase 2 - Cluster Bootstrap

export SSL_CERT_FILE=$(python3 -c "import certifi; print(certifi.where())")
terraform apply -auto-approve

Resources created: Namespaces, ArgoCD, NGINX Ingress, cert-manager, Sealed Secrets, kube-prometheus-stack (Prometheus + Alertmanager + Grafana), DNS module (Route53 + ACM).

Expected output:

Apply complete! Resources: 16 added, 0 changed, 0 destroyed.